CVE-2025-8404
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A stack buffer overflow vulnerability exists in the Supermicro BMC shared library. An authenticated attacker with access to the BMC can exploit the stack buffer via a crafted header and achieve arbitrary code execution in the BMC firmware operating system.
Risk Assessment
An authenticated attacker may take control of the BMC firmware, potentially leading to full compromise of server management and persistent security breach.
Recommendation
Update BMC firmware to the version containing the Supermicro fix. Restrict BMC interface access to trusted networks and enforce strong authentication.
Other vulnerabilities in Supermicro BMC
See all- CVE-2026-3820High
A vulnerability in the Supermicro BMC SMTP service on model AS-2115HS-TNR allows an attacker to gain administrator privileges and inject specially crafted characters into the SMTP configuration, potentially causing unintended command execution during process invocation.
- CVE-2023-33412High
A vulnerability in the web interface of the BMC (IPMI) on Supermicro X11 and M11 devices with firmware versions before 3.17.02 allows remote authenticated users to execute arbitrary commands via a crafted request targeting vulnerable CGI endpoints.
- CVE-2023-33411High
A web server in the BMC (IPMI) implementation on Supermicro X11 and M11 devices with firmware up to 3.17.02 allows remote unauthenticated attackers to perform directory traversal, potentially disclosing sensitive information.
Original NVD description (English source)
Stack buffer overflow vulnerability exists in the Supermicro BMC Shared library. An authenticated attacker with access to the BMC exploit stack buffer via a crafted header and achieve arbitrary code execution of the BMC’s firmware operating system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS